Security Bulletin: Langflow is affected by remote code execution, denial of service, path traversal, and exposed credentials due to multiple unauthenticated and insufficiently authorized API endpoints

Summary Langflow provides a visual interface for constructing and executing AI-powered agent workflows, exposing HTTP API endpoints for flow execution, file management, vector store operations, and Model Context Protocol MCP server configuration. An attacker could exploit insufficient validation...

CVE-2026-57476: Missing Authentication for Critical Function

Deloitte AI Assist for Customer exposed unauthenticated API endpoints that allowed an attacker with knowledge of additional parameters to read from or inject content into the retrieval-augmented generation RAG corpus. On 2026-03-25, AI Assist for Customer restricted network access and enforced...

CVE-2026-13007

Tenable Identity Exposure contains multiple unauthenticated API endpoints under /w/api/ that expose sensitive application configuration data including cleartext LDAP credentials, SAML configuration, user accounts, and directory settings to unauthenticated remote attackers. Affected responses are...

Cisco Catalyst Center 访问控制错误漏洞

Cisco Catalyst Center Cisco DNA Center is a network management system from Cisco USA. An access control error vulnerability exists in Cisco Catalyst Center that stems from a lack of authentication of API endpoints, which could lead to agent configuration modification attacks...

Design/Logic Flaw

An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. There are Unauthenticated API Endpoints...

CVE-2021-33221

CommScope Ruckus IoT Controller (1.7.1.0 and earlier) exposes unauthenticated API endpoints. The Nuclei template details a service-details endpoint that leaks system/config data (DNS/NTP, hostname, version, etc.), a diagnostic endpoint that can generate CPU/disk-heavy files, and a reset endpoint ...

CommScope Ruckus IoT Controller 1.7.1.0 Unauthenticated API Endpoints

KL-001-2021-001: CommScope Ruckus IoT Controller Unauthenticated API Endpoints Title: CommScope Ruckus IoT Controller Unauthenticated API Endpoints Advisory ID: KL-001-2021-001 Publication Date: 2021.05.26 Publication URL: https://korelogic.com/Resources/Advisories/KL-001-2021-001.txt 1...